Revocation of Student Data Export Access

Protocol status

Study design uses one bounded observation unit, ten evidence fields, seven adverse states, and one authority map; these are protocol counts, not performance claims.

This page describes a review design and its proposed controls. It does not report an executed sample, measured outcomes, or evidence that the controls improved performance.

Review protocol

research question EVA-R-5-1 asks whether download, sharing, storage, retention, and access pathways close after purpose, role, or authorization ends. The observation unit is one export authorization across approval, transfer, use, expiry, deletion, and independent verification. Reviewers retain original customer wording, actor, channel, timestamp, timezone, case identity, system event, policy or answer version, permission state, correction history, and consequence. They sample ordinary, incomplete, conflicting, corrected, urgent, inaccessible, and reopened cases. Direct observation, named report, inference, and authorized decision remain separate. Missing evidence stays missing. privacy officer and system owner retain consequential authority. Report numerators with denominators, exclusions, unresolved cases, and gap concentration, then require a second reviewer to reproduce the chronology without private context.

Planned review sequence

1. Define the observation unit
2. Declare the sample and exclusions
3. Preserve evidence hierarchy
4. Reconstruct the chronology
5. Design adverse controls
6. Code authority transitions
7. Measure learner acknowledgement
8. Audit privacy and minimization
9. Run independent review
10. State limitations and refresh triggers

Operational implications

For student data export revocation, a closed ticket is weaker than a linked chain containing original wording, versioned evidence, authority decision, delivered message, acknowledgement, and residual work.

Missing evidence in one export authorization across approval, transfer, use, expiry, deletion, and independent verification must not be replaced by habit, a likely explanation, or a favorable outcome; doing so hides the process weakness the review should expose.

Permission to coordinate does not imply permission to disclose, diagnose, credit, restrict, or make regulated judgments. The authority map must name privacy officer and system owner.

Adverse review should include wrong identity, stale answer, contradictory state, inaccessible source, late correction, privacy-sensitive content, and failed acknowledgement.

A reproducible EVA-R-5 record retains original local time and field values beside normalized values so boundary cases remain reviewable.

Pilot student data export revocation in a declared cohort, repair gaps, secure owner acceptance, test rollback, and refresh after any system, role, policy, or risk change.